id_tokens:
    KSC_ID_TOKEN:
        aud: keyserver

stages:
  - build
  - await_approval
  - sign

variables:
  # This is the URL of your keyserver.
  KSC_API_SERVER: "https://keyserver.<UNIQUE-ID>.cryptera-security.io"
  # This is the hash algorithm that will be used for signing in the sign_binary job.
  HASH_ALGORITHM: "-sha256"
  # This is the key ID that will be used for signing in the sign_binary job. 
  # It should match the key ID that you have set up in your key server for production use. 
  # In a real setup, you would replace "key1" with the actual key ID you want to use for signing.
  KEYID: "key1"
  # Description that will be attached to the signing operation for auditing purposes. 
  # It should help approvers understand the context of the operation when asked to approve
  KSC_OPERATION_DESCRIPTION: "GitLab PKCS11 signing"
  #  Sources to build from
  LIBPKCS11KS_REPO: "https://github.com/cryptera-device-security/libpkcs11ks.git"
  PKCS11MOD_REPO: "https://github.com/cryptera-device-security/pkcs11mod.git"
  # Approval wait period in seconds (e.g., 120 seconds)  
  WAIT_FOR_APPROVAL: 120
  # (Optional, Default: 10s) LibPKCS11ks client time out for calls against Keyserver
  KSC_HTTP_CLIENT_TIMEOUT: "15s"

build_libpkcs11ks:
  stage: build
  image: golang:1.20
  variables:
    CGO_ENABLED: 1
    GOOS: linux
    GOARCH: amd64
  before_script:
    - apt-get update && apt-get install -y git
    - cd $CI_PROJECT_DIR
    # Clone both repos
    - git clone "$PKCS11MOD_REPO"
    - git clone "$LIBPKCS11KS_REPO"
    # Set up pkcs11mod
    - cd pkcs11mod
    - go mod init github.com/namecoin/pkcs11mod
    - go mod tidy
    - go generate ./...
  script:
    # Build libpkcs11ks with pkcs11mod as a replace target
    - cd $CI_PROJECT_DIR/libpkcs11ks
    - go mod edit -replace github.com/namecoin/pkcs11mod=../pkcs11mod
    - go mod tidy
    - chmod +x build.sh
    - ./build.sh
  artifacts:
    paths:
      - libpkcs11ks/libpkcs11ks.so
    expire_in: 1 week


request_operation_await_approval:
  stage: await_approval
  image: ubuntu:24.04

  # When using GitLab's built-in JWT, set the audience to "keyserver", and make sure your keyserver instance is configured to accept GitLab's JWTs.
  id_tokens:
    KSC_ID_TOKEN:
      aud: "keyserver"

  before_script:
    - export DEBIAN_FRONTEND=noninteractive
    - apt-get update
    - apt-get install -y jq curl

  script: |
    set -Eeuo pipefail
    echo "== Create operation for $KEYID =="
    KSC_OPERATION_ID=$(curl -sS --tlsv1.3 -X 'POST' \
      "$KSC_API_SERVER/api/operations" \
      -H "Authorization: Bearer $KSC_ID_TOKEN" \
      -H 'accept: application/json' \
      -H 'Content-Type: application/json' \
      -d '{
        "validms": 600000,
        "description": "'"$KSC_OPERATION_DESCRIPTION"'",
        "new-keyusagerestrictions": [
          {
            "keyid": "'"$KEYID"'",
            "maxusagecount": 1
          }
        ]
      }' | jq -r .id)

    if [ -z "$KSC_OPERATION_ID" ] || [ "$KSC_OPERATION_ID" = "null" ]; then
      echo "Failed to obtain KSC_OPERATION_ID"
      exit 1
    fi
    echo "Operation ID $KSC_OPERATION_ID"

    # At this point, you would typically notify the relevant approvers that an operation is awaiting their approval. 
    # This could be done via email, Slack, or any other communication tool your team uses. 
    # The notification should include details about the operation
    # Note that when using keys that does not require approval, approved will be true immediately and the loop will exit without waiting.
    echo "== Wait for approval (max ${WAIT_FOR_APPROVAL}s) =="
    for ((i = 1; i <= WAIT_FOR_APPROVAL / 5; i++)); do
      STATUS=$(
      curl -sS --tlsv1.3 -X GET "$KSC_API_SERVER/api/operations/$KSC_OPERATION_ID" \
        -H "Authorization: Bearer $KSC_ID_TOKEN" \
        -H 'accept: application/json' | jq -r .approved
      )

      if [ "$STATUS" = "true" ]; then
      echo "Operation ID $KSC_OPERATION_ID is approved"
      break
      else
      echo "Not approved yet"
      sleep 5
      fi
    done
    echo "Status  $STATUS"
    [ "$STATUS" = "true" ] || { echo "Approval timed out"; exit 1; }

    echo "KSC_OPERATION_ID=$KSC_OPERATION_ID" > approval.env

  artifacts:
    reports:
      dotenv: approval.env
    expire_in: 1 hour



sign_binary:
  stage: sign
  image: ubuntu:24.04
  needs:
    - job: build_libpkcs11ks
    - job: request_operation_await_approval

  id_tokens:
    KSC_ID_TOKEN:
      aud: "keyserver"

  before_script: |
    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    ca-certificates curl jq openssl libengine-pkcs11-openssl



  script: |
    set -Eeuo pipefail

    mkdir -p "$CI_PROJECT_DIR/scripts"
    cp -f "$CI_PROJECT_DIR/libpkcs11ks/libpkcs11ks.so" "$CI_PROJECT_DIR/scripts/libpkcs11ks.so"

    echo "== Generate OpenSSL PKCS#11 config =="
    cat >"$CI_PROJECT_DIR/scripts/openssl-ks.cnf" <<EOF
    openssl_conf = openssl_init

    [openssl_init]
    engines = engine_section
    providers = provider_sect

    [provider_sect]
    default = default_sect
    base = base_sect

    [default_sect]
    activate = 1

    [base_sect]
    activate = 1

    [engine_section]
    pkcs11 = pkcs11_section

    [pkcs11_section]
    engine_id = pkcs11
    dynamic_path = /usr/lib/x86_64-linux-gnu/engines-3/libpkcs11.so
    MODULE_PATH = $CI_PROJECT_DIR/scripts/libpkcs11ks.so
    init = 0
    EOF

    export OPENSSL_CONF="$CI_PROJECT_DIR/scripts/openssl-ks.cnf"
    #export KSC_API_SERVER="$KSC_API_SERVER"
    #export KSC_OPERATION_DESCRIPTION="$KSC_OPERATION_DESCRIPTION"

    #: "${KSC_OPERATION_ID:?Missing KSC_OPERATION_ID from request_production_approval job}"
    echo "Using approved Operation ID: $KSC_OPERATION_ID"

    echo "== Sign test file with OpenSSL + PKCS#11 =="
    echo "Test" > test.txt

    openssl dgst \
      -engine pkcs11 \
      -keyform engine \
      -sign "pkcs11:object=${KEYID}" \
      ${HASH_ALGORITHM} \
      -out test.txt.sig \
      test.txt

    ls -l test.txt.sig

    echo "== Get public key for the signing key, as part of validation step =="
    curl -sS  --tlsv1.3 \
      -H "Authorization: Bearer $KSC_ID_TOKEN" \
      -H "Accept: application/json" \
      "$KSC_API_SERVER/api/keys/$KEYID" \
      | jq -er '.certificate' > certificate.pem


    # Extract pubkey from cert
    openssl x509 -in certificate.pem -pubkey -noout > pubkey.pem

    echo "== Verify signature against public key =="
    openssl dgst \
      -verify pubkey.pem \
      ${HASH_ALGORITHM} \
      -signature test.txt.sig \
      test.txt

    echo "Signature verification OK"

  artifacts:
    name: "signed-output-$CI_COMMIT_REF_NAME-$CI_COMMIT_SHORT_SHA"
    when: always
    expire_in: 14 days
    paths:
      - scripts/openssl-ks.cnf
      - scripts/libpkcs11ks.so
      - test.txt
      - test.txt.sig
      - certificate.pem
      - pubkey.pem